Sanitized parameter inputs

[BigRed1212]

I just realized I may not have doing what I thought I was doing and I may need to do it. Love that sentence.


Currently I take in user input from a form:

fname=Request.Form("fname")
lname=Request.Form("lname")
city=Request.Form("city")
etc..

I connect to the database:

data_source - Provider=Microsoft.Jet.OLEDB.4.0; Data Source=" etc .mdb
Set con = Server.CreateObject("ADODB.Connection")
con.Mode = 3
con.Open data_source

I execute a stored procedure:

con.insert_datathing fname, lname, city, etc..
con.Close
Set con = Nothing

Should I be adding a step?:

Function DeleteChars(str)
Set regex = New RegExp
regex.pattern="([URL unfurl="true"]http://|\.js|[/URL][\\{}':%()])"
regex.Global = True
DeleteChars = regex.Replace(str,"")
Set regex = Nothing
End Function

(The above written for me here BTW before I started using the stored procedure and was just doing a direct insert)

and doing something like (not sure of the syntax and how I would do it):

con.insert_datathing DeleteChars(fname), DeleteChars(lname), DeleteChars(city),  etc...

or does just using the stored procedure by itself reduce/eliminate my vulnerability to an injection attack so that I don't need to run the input sanitization?

 

[Remou]

These may be of interest:

http://articles.techrepublic.com.com/5100-10878_11-6159742.html?tag=rbxccnbtr1#comments

http://www.owasp.org/index.php/OWASP_Top_Ten_Project

I do not think the regex you show is suitable in that it will remove valid characters. You may wish to look at URL encoding and HTML encoding.

http://lessthandot.com

 

[BigRed1212]

I do not think the regex you show is suitable in that it will remove valid characters. You may wish to look at URL encoding and HTML encoding.

Well, without getting into the details of regex (which I don't speak and as I indicated I didn't write), and having looked at those two articles, I guess my larger question still stands: Do I need to sanitize parameter inputs (using regex or encoding or whatever) or does just making them parameters get the job done?

 

[BigRed1212]

Ok. I should have asked this in another forum maybe.